Do you need a notified body under the EU AI Act, and how do you choose one?
Most Annex III high-risk systems do not need a notified body. Under Article 43, most of them use internal control under Annex VI, where the provider runs the conformity assessment itself. A notified body is required for some biometric systems and for Annex I product systems, and whether it is required for a biometric system depends on whether the provider applied harmonised standards or common specifications. If your customer, contract or regulator asks for AI Act conformity evidence, start by identifying the system's category under Annex III or Annex I, then check which route Article 43 assigns to it. Only then does the choice of a body arise. Your organization owns its controls and remains responsible for the declaration of conformity. An implementation partner such as DeployOpen can prepare systems, documentation and evidence for the assessment, but only the notified body issues the certificate.
Begin by confirming three facts in writing: the Annex category of each system, whether you applied the relevant harmonised standards in full, and the date your system must comply under the 2026 amendments, which moved the Annex III high-risk rules to 2 December 2027 and the Annex I rules to 2 August 2028. The Commission's public list of notified bodies, which the Commission must keep current under Article 35, is the first place to check whether a body is notified for the specific activity you need. Ask each candidate for its notification scope, its single identification number, its list of subsidiaries and any subcontractors, because Article 33 makes the body fully responsible for subcontracted work and requires your agreement before it is used. Confirm that the body has permanent access to staff with experience of your type of AI system, and that it is independent of you and of your competitors.
Ask every candidate for a written quote that separates the document review from the quality management system audit, since the Commission's 2021 impact assessment estimated these as different activities (impact assessment accompanying the AI Act proposal). Those figures are estimates from 2021 and may not reflect current fees, so treat them as a starting point for questions, not a budget. Ask which costs recur, such as yearly re-audits, and how certificate renewal works, since Article 44(2) limits certificate validity to four years for Annex III systems and five years for Annex I systems. Article 34(2) requires bodies to consider the size of the provider, so ask whether the body applies it and how. Finally, plan your evidence before the first meeting, because a well-prepared file shortens the review and the cost that follows from it.
Which systems require third-party assessment
Most AI Act high-risk systems do not need an outside body to assess them. A small set does, and the route depends on whether the system is a biometric system under Annex III, a product covered by Annex I legislation, or something else. Work through these cards in order before you contact any notified body.
Biometric systems under Annex III point 1
Biometric identification and categorisation systems in Annex III point 1 have a choice of routes, but only if you applied the harmonised standards or common specifications that cover them. If you did, Article 43(1) lets you pick internal control under Annex VI or assessment by a notified body under Annex VII. If you applied them only in part, or not at all, Annex VII is mandatory. Confirm in writing which standard clauses you applied before you decide.
Annex I Section A product systems
AI systems that are safety components of products covered by the Annex I Section A sectoral legislation follow the sectoral conformity procedure, which folds in the AI Act requirements and a quality management system assessment. Your notified body under that product legislation must be designated for the AI Act as well. Ask your current body whether it has applied for AI Act designation, because the application deadline is a fixed date you should plan around.
Other Annex III systems on internal control
Most other Annex III high-risk systems, such as those used in hiring, credit scoring or education, are assessed through internal control under Annex VI. Your organization carries out the quality management review, the technical documentation check and the conformity declaration itself, with no notified body involved. This is where the outside cost usually falls to readiness support, not to the assessment. Check that your system falls outside the biometric and Annex I routes before relying on it.
Mixed systems that fall under two routes
A system can be a biometric Annex III system and also a component of a regulated product, which puts it on more than one route. The stricter route generally governs the conformity assessment, so a notified body may be needed even where a single route looks optional. Map each system against both annexes and record the reasoning in your technical file. Ask any notified body to confirm its scope covers every route that applies.
Systems that change after assessment
A substantial modification to a system already assessed can move it onto a different route or require a fresh assessment. Changes to the intended purpose, the training approach or the model architecture are the typical triggers. Build a change-control check into your release process so that each update is classified against the assessment that covers it. Document the decision, even when the answer is that no reassessment is needed.
How the notified body route runs from application to certificate
The sequence shows how a provider moves from confirming that a notified body is required to holding a certificate it can rely on, and what each phase must hand over before the next one starts. It is run by the provider with its notified body, and the certificate is issued only by the notified body.
Confirm the notified body route applies
Before contacting any body, the provider confirms which conformity assessment route its system uses. For biometric systems under Annex III point 1, Article 43(1) lets providers that applied harmonised standards or common specifications choose between internal control under Annex VI and notified body assessment under Annex VII. Without those standards, or with only partial application, Annex VII is required. For Annex I Section A products, Article 43(3) applies the sectoral procedure, which includes the AI Act requirements and a quality management system assessment. Output: a written routing decision, signed off by the compliance owner, that cites the article relied on and the harmonised standards applied or not applied.
Shortlist bodies from the Commission's list
The provider checks the Commission's public list of bodies notified under the AI Act, which shows each body's identification number and the activities it is notified for. Only bodies notified for the specific activity and system type are candidates. The provider then asks each shortlisted body to confirm its notified scope in writing, its independence from the provider and its competitors, and its access to staff with experience of the relevant AI systems, data and high-risk requirements. Output: a shortlist with each body's number, notified activity and written confirmation of scope and staffing. Confirm the current list before relying on it, since designations change.
Apply and agree the assessment scope
The provider submits an application to its chosen body describing the system, its intended purpose, its quality management system and the technical documentation it holds. The body and provider agree the scope in writing, including which system versions, which quality management processes and which subcontracted tasks are covered. Under Article 33, a body may subcontract only with the provider's agreement, remains fully responsible for that work and must publish a list of its subsidiaries, so the provider should ask for that list now. Ask the body for a written quote that separates the documentation review from the quality management audit and states the basis for each fee. Output: a signed scope statement and a quote that matches it.
Complete the documentation review
The body reviews the technical documentation against the requirements for high-risk systems and the conformity assessment procedure. The provider supplies the documents, answers questions and records each change made in response. The Commission's 2021 impact assessment (SWD(2021) 84 final) estimated this review at one to two and a half days, or EUR 3,000 to 7,500, a figure that predates the 2026 amendments and should be confirmed with the body for the current scope. Output: a documentation review report listing open questions, each with an owner and a status.
Undergo the quality management system audit
The body audits the provider's quality management system on site or remotely, testing whether the processes described in the documentation operate in practice. The Commission's 2021 impact assessment (SWD(2021) 84 final) estimated an initial audit at EUR 1,000 to 2,000 per day, with yearly re-audits. Ask the body to state its day count and any travel or subcontractor costs in the quote, because the total depends on the number of sites, processes and system versions in scope. The harmonised standard EN 18286:2026 on quality management was cited in the Official Journal on 14 October 2026, so ask the body whether it assesses against that standard. Output: an audit report with findings classified by severity.
Close findings and make corrections
The provider responds to each finding with a root cause, a corrective action and evidence that the action works. The body verifies the corrections and records whether each finding is closed. Major findings must be resolved before the body can decide on certification, so the provider should plan the corrective work and any follow-up audit with the body in writing. Output: a closure record showing every finding as closed or still open, and the body's decision to proceed or to withhold.
Receive the certificate from the body
The body issues the certificate only after its decision is recorded. Under Article 44(2), certificates are valid for at most five years for Annex I systems and four years for Annex III systems, and they are renewable after reassessment. The provider should record the expiry date, the certified scope and the body's identification number in its compliance register, and it should not describe the system as certified beyond that scope. Output: the certificate, its scope statement and the expiry date, filed with the technical documentation.
Maintain the certificate through yearly surveillance
After certification, the provider keeps the quality management system operating and notifies the body of changes that affect the certified scope. The body performs yearly re-audits, which the Commission's 2021 impact assessment (SWD(2021) 84 final) also assumed, so the recurring cost is the annual audit and the internal effort to keep evidence current. Output: an annual surveillance report and a change log that the provider can show to the body and to market surveillance authorities on request.
What a notified body assessment costs and who gets paid
This table separates the parties who get paid in a notified body assessment, from the notified body itself to your implementation partner, internal staff and tooling. It marks which costs are one-time and which recur, so you can request quotes that compare like with like. The Commission's 2021 figures are estimates from an impact assessment, not current fees, so confirm every number against a written quote for your scope.
| Cost component | Who is paid | One-time or recurring | What drives it |
|---|---|---|---|
| Documentation review | Notified body | One-time per assessment | Size and completeness of the technical documentation, and how many review days the body plans; the Commission's 2021 impact assessment estimated one to two and a half days, or EUR 3,000 to 7,500 |
| Initial QMS audit | Notified body | One-time per certificate | Number of audit days, number of sites and the quality management system's maturity; the 2021 impact assessment estimated EUR 1,000 to 2,000 per day |
| Yearly re-audits | Notified body | Recurring, typically yearly | Surveillance scope and changes to the system; the 2021 impact assessment assumed yearly re-audits, so ask for the surveillance schedule in writing |
| Certificate renewal | Notified body | Recurring, every four or five years | Certificate validity under Article 44(2): four years for Annex III systems, five years for Annex I systems, with reassessment before renewal |
| Preparing systems and evidence | Implementation partner or consultant | One-time, with later updates | Gap analysis, documentation drafting, logging and testing setup; scope agreed in writing before work starts |
| Internal staff time | Your own employees (no external payee) | Recurring during preparation and audits | Number of engineers, compliance staff and product owners who answer auditor questions and keep records current |
| Tooling and infrastructure | Software vendors, hosting providers or your cloud account | Mix of one-time setup and recurring licenses or hosting | Licence model, self-hosting footprint and logging volume; confirm licence terms with each vendor |
| SME cost minimization | Reduces notified body cost, not a payee | Applies to each assessment | Article 34(2) requires bodies to limit unnecessary burden and take size into account, especially for micro and small enterprises; ask how the body applies this to your quote |
What makes a notified body assessment cost more or take longer
Notified body fees and calendar time follow the size and clarity of what is being assessed. The cards below cover the inputs a provider controls before the first review, and the written agreements that keep the scope fixed once the assessment starts.
Scope and system count
Every AI system, version and intended purpose inside the assessment scope adds documentation to review and audit days to plan. A single, written scope statement listing each system, its Annex reference and its included versions is the first thing to agree with the body. Ask the body to confirm in writing which systems, changes and sites the quote covers, and what happens if a system is added during the review.
Documentation maturity
A notified body reviews technical documentation against the high-risk requirements, and gaps found late cost more than gaps found by your own team. Assemble the technical file, risk management records, data governance evidence and logging design before you request the review. Reviewers who must chase missing items extend the time spent on each round of questions.
Sites and supply chain
Each development site, hosting region and third party that supplies data, models or components widens the audit trail the body must sample. Map every location and external supplier that touches the system, and collect the contracts and quality evidence for each one in advance. Confirm with the body how many sites it expects to visit and whether remote review is accepted for some of them.
Subcontracting to other bodies
A notified body may subcontract tasks or use a subsidiary only with your agreement, and it stays fully responsible for that work. Ask whether any part of the assessment goes to a subcontractor, which tasks, and whether that party is on the body's published subsidiary list. Put the subcontracting terms in the contract so that a change does not add cost or delay the schedule unexpectedly.
Size and sector of the provider
The Act requires notified bodies to avoid unnecessary burdens and to take account of provider size, sector and structure, with particular attention to micro and small enterprises. Smaller providers should say so when requesting a quote and ask how the body scales its effort for a small quality management system. Confirm the basis for any reduction in writing, since the scope and fee follow from it.
Complexity of the system
A system with many functions, learning components or safety-relevant behavior needs deeper testing and a longer review than a narrow tool with fixed outputs. Describe the model, its training and update cycle, and its failure modes before the quote is prepared. Ask the body how it will test complexity and whether a pre-assessment call can identify areas that will need extra review time.
Who does what: provider, partner and notified body
The provider remains legally responsible for the high-risk AI system and for every control in it. The compliance owner decides whether the system falls under internal control or needs a notified body, and that decision is documented before any assessment is booked. The owner also signs off the quality management system, the technical documentation and the declaration of conformity. An outside party can prepare material, but the provider has to be able to explain and defend every control in it.
- Classification decision: Record which Annex III point or Annex I product route applies, and why, before scoping any assessment.
- Conformity route choice: Decide between internal control and notified body assessment, and confirm whether harmonised standards or common specifications were applied in full.
- Accountable sign-off: Approve the quality management system, technical documentation and EU declaration of conformity under the provider's name.
- Assessor engagement: Select the notified body, agree the scope in writing and keep the assessor's correspondence and reports on file.
- Ongoing duties: Own post-market monitoring, incident handling and any changes that may require reassessment.
Before engaging anyone, confirm internally who holds the decision on the conformity route and who signs the declaration of conformity.
An implementation partner helps the provider build the evidence that an assessment will examine. Its work covers documentation, quality management procedures, data governance records, logging design and testing records. The partner works inside the provider's environment and under the provider's direction. It does not decide the conformity route, does not issue any assessment, and cannot issue a certificate. Its independence from assessment is a matter of role, so the partner should not be the party that later reviews the same work.
- Documentation preparation: Draft technical documentation, risk management records and instructions for use for the provider to review and adopt.
- QMS evidence: Set up procedures, change control and records that show the quality management system operates in practice.
- Testing records: Support testing plans, test results and remediation tracking that feed the assessment file.
- Gap analysis: Compare current evidence against the Article 8 to 15 requirements and report gaps for the provider to decide on.
- Clear boundaries: Put the partner's role in writing so the provider, not the partner, owns every control and every claim made to the assessor.
Ask any partner to state in its proposal which tasks it performs and which it explicitly does not perform, including any role in the notified body's review.
A notified body is an independent conformity assessment body that the Member State's notifying authority has designated under the AI Act. It performs the third-party assessment for the systems that require it, reviews documentation and the quality management system, issues certificates, and carries out surveillance over the certificate's life. Article 31 sets its independence rules: it must be established under a Member State's law with legal personality, be independent of the providers it assesses and their competitors, and keep its staff out of the design, development, marketing or use of high-risk AI systems. Article 31 also requires liability insurance and permanent access to staff with the relevant technical and legal experience.
- Independence boundary: A notified body cannot design, develop, market or use the system it assesses, so it cannot also build the documentation it reviews.
- Assessment and certificate: It issues the certificate only after its own review, and certificate validity is set by Article 44(2) at up to five years for Annex I systems and four years for Annex III systems.
- Subcontracting limits: It may subcontract or use a subsidiary only with the provider's agreement, remains fully responsible for that work, and must publish its subsidiaries under Article 33.
- Listing: Check the Commission's published list of notified bodies and the activities each one is notified for.
- Surveillance: Expect periodic reassessment and updates as a condition of keeping the certificate.
Before signing, confirm the body's notified activities on the Commission's list and ask it to describe, in writing, how it keeps assessment staff separate from the teams that prepared the provider's documentation.
How to check a notified body before you sign
A notified body's value rests on its status, independence and staffing, so each check below tests one of those. Run them before you sign, and record the answers in your conformity file so you can show the assessment was properly chosen.
Confirm the Commission's public list
Article 35 requires the Commission to publish and keep current the list of bodies notified under the AI Act, with each body's identification number and the activities it is notified for. Check that the body appears on that list, that its number matches the one on its documents, and that the notified activity covers your system's category, such as biometric assessment or an Annex I product procedure. A body notified for a different activity cannot issue the certificate you need. Ask for the number in writing before you sign.
Verify legal personality and insurance
Under Article 31, a notified body must be established under the law of a Member State with legal personality, and it must carry liability insurance. Ask for the registration details of the legal entity that will sign your contract, confirm which Member State it is established in, and request evidence of current liability cover. Confirm that the contracting entity is the same body that is notified, since a subsidiary or affiliate may not hold the notification.
Test independence from you and your rivals
A notified body must be independent of the providers it assesses and of their competitors, and its staff must stay out of designing, developing, marketing or using the high-risk systems it reviews. Ask whether the body has provided consultancy, pre-assessment or development support to your system or to a direct competitor. Ask who on the assessment team has any prior role in your product. A body that also sells implementation work to you creates a conflict you must document and challenge.
Confirm staff expertise and permanent access
Article 31(11) requires permanent access to administrative, technical, legal and scientific staff with experience of the relevant AI systems, data and data computing, and of the high-risk requirements. Request the named disciplines that will work on your file, their experience with systems like yours, and how the body retains that capacity. Ask how many of the staff are permanent employees rather than contractors, because permanent access is what the Act requires.
Review subsidiaries and subcontracting terms
Under Article 33, a notified body may subcontract tasks or use a subsidiary only with your agreement, and it stays fully responsible for that work. It must also publish a list of its subsidiaries. Before signing, write down which tasks may be subcontracted, require the subcontractor's name and location, and check the published subsidiary list against what the body tells you. Make your consent specific and revocable in the contract, so you know who reviews your evidence.
Check certificate term and renewal scope
Under Article 44(2), a notified body certificate lasts at most five years for Annex I systems and four years for Annex III systems, and it can be renewed only after reassessment. Ask how the body plans reassessment, what triggers an earlier review after a substantial change to your system, and how it notifies you of suspension or withdrawal. Agree these points in the contract so renewal does not depend on a single scheduling conversation.
How long a notified body certificate lasts and what renewal requires
Under Article 44(2) of the AI Act, a notified body certificate is valid for at most five years for Annex I systems and at most four years for Annex III systems, and it can be renewed only after the notified body reassesses the system. The reader should treat these figures as ceilings, not guarantees: the certificate expiry date is set by the notified body's decision, and the contract should state how the notified body will handle surveillance between issue and expiry. The Commission's 2021 impact assessment, cited in the topic sources, assumed yearly re-audits of the quality management system during that validity period. Ask the notified body in writing whether it plans annual surveillance audits, what each audit covers, how many audit days it budgets for, and how any finding that arises between audits will be reported and closed.
The 2026 amendment moved the high-risk dates in Chapter III Sections 1 to 3. Annex III systems now face these rules from 2 December 2027, and Annex I product systems from 2 August 2028, instead of 2 August 2026 and 2 August 2027. Notified bodies designated under Annex I Section A product legislation must apply for AI Act designation by 28 January 2028 (Article 43(3)). For a provider planning a first certificate, this means checking early whether the body it intends to use already holds, or is in the process of obtaining, designation for the relevant activity. A certificate issued by a body without that designation will not help the provider in the market. Confirm the body's current designation status on the Commission's public list of notified bodies before signing.
Renewal is a reassessment, not a paperwork exercise. Plan the renewal date backward from the certificate expiry, and ask the notified body how long its reassessment usually takes, what it will request from the provider (changes to the system, post-market monitoring records, incident logs and updated technical documentation), and whether the same team will conduct it. Any substantial modification to the system during the certificate period may require the notified body's involvement before the change is placed on the market, so the change management process should route such changes to the notified body early. Record in the contract who pays for surveillance audits, reassessment and re-issuance, because those costs recur over the life of the certificate and are often not included in the initial quote.
Questions buyers ask about notified bodies under the AI Act
Does a typical Annex III high-risk AI system need a notified body?
Usually no. Most Annex III high-risk systems use internal control, the conformity assessment procedure in Annex VI, where the provider runs the assessment itself and keeps the technical documentation. The main exception is Annex III point 1, the biometric systems. For those, Article 43(1) lets a provider choose internal control or notified body assessment only if it has applied the harmonised standards or common specifications in full. Without them, or with partial application, a notified body assessment under Annex VII is required. Check which Annex III point your system falls under before you budget for third-party work.
How long does a notified body assessment take, and what must the provider supply?
The timeline depends on the system, the conformity route and the body's queue, so ask each candidate for its own schedule in writing. The Commission's 2021 impact assessment, SWD(2021) 84 final, estimated a notified body review of a system's documentation at one to two and a half days, or EUR 3,000 to 7,500, and an initial quality management system audit at EUR 1,000 to 2,000 per day, with yearly re-audits. Those figures are a 2021 estimate and predate the 2026 amendments, so treat them as a starting point. Providers should be ready with the technical documentation, the quality management system records, the risk management file, data governance evidence and the test reports for the system.
Can a consulting partner prepare the evidence for a notified body, and what can it not do?
A partner can prepare systems, controls and evidence, including the technical documentation, logging configuration, test records and quality management system files that the notified body will review. A partner cannot issue the assessment, sign off the conformity result or certify the system. Only the notified body does that. Article 31 also requires notified bodies to stay independent of the providers they assess and to keep their staff out of the design, development, marketing or use of high-risk AI systems. A partner that helped build the system may therefore be unable to act as the assessor, so keep the preparation and assessment roles separate in your planning.
Is a notified body allowed to subcontract its assessment work?
Yes, but only with the provider's agreement. Under Article 33, a notified body may subcontract tasks or use a subsidiary for the assessment, but it must get the provider's consent first and it remains fully responsible for the work it hands off. It must also publish a list of its subsidiaries. Before you sign, ask which tasks would be subcontracted, who the subcontractors are, where they are based and whether you can review that list. Write the consent into the contract so that you are not surprised by a change of assessor partway through.
How does SME relief apply when choosing a notified body?
Article 34(2) requires notified bodies to avoid unnecessary burdens for providers and to take account of their size, sector, structure and the complexity of the system. The article specifically asks bodies to minimise costs for micro and small enterprises. In practice, the scope of the assessment, the number of days needed and the fee structure can all be shaped by the provider's size and system complexity. Ask each body how it applies that duty in its written quote, and confirm which parts of the fee are fixed and which depend on the review effort.
What should I confirm before signing a notified body contract?
Confirm that the body is on the Commission's public list of bodies notified under the AI Act, with its identification number and the activities it is notified for. Check that the body is established in a Member State, that its notifying authority covers the activity you need, and that it carries liability insurance. Ask how long the certificate runs, since Article 44(2) limits certificates to at most five years for Annex I systems and four years for Annex III systems, with renewal after reassessment. Also confirm the subcontracting terms, the staff with relevant AI and data expertise, the re-audit schedule and what a change to your system would trigger.
When does the notified body requirement for biometric and product systems apply?
Notified body involvement for Annex I Section A products runs through the sectoral legislation, and under Article 43(3) notified bodies under that legislation must apply for AI Act designation by 28 January 2028. The 2026 amendment moved the high-risk dates to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems. Confirm with your product regulator and the notified body which conformity route applies to your product, and check the Commission's list before you commit, since designations are still being added.
What delays notified body projects and how to avoid it
Most notified body projects slip for reasons that are visible early: the wrong body, an unconfirmed conformity route, thin documentation, or a vague scope. Each card below names one cause and the check that prevents it, so the assessment starts on the right track.
Body not notified for your activity
A notified body can only assess the activities listed against its designation, and the Commission publishes that list with each body's number. A body may be notified for biometric assessment but not for the Annex I sectoral route your product falls under. Before signing, confirm on the Commission's public list that the body holds the exact activity your system needs, and ask for the designation scope in writing.
Route confirmed too late
Whether a system needs notified body assessment depends on its category. For biometric systems in Annex III point 1, the outcome depends on whether harmonised standards or common specifications were fully applied. Teams that discover this after drafting documentation often restart the file. Settle the route at the classification stage, record the reasoning, and confirm it with the body before scoping.
Unprepared technical documentation
A notified body reviews the system's documentation before it tests anything else, and gaps there send the file back. Missing risk management records, unclear data governance, or logs that do not match the stated design all cost time. Ask the body for its document checklist early, then run an internal gap review against it so the submission is complete on the first pass.
Unclear scope and system boundary
The body certifies a defined system, version and intended purpose. If the team has not fixed which models, datasets, interfaces and deployment settings are inside the boundary, the assessor cannot finish the review and the quote shifts. Write a scope statement that names the system version, its intended purpose and its exclusions, and agree it in writing before the application.
Waiting on designations under Annex I
Notified bodies under Annex I Section A product legislation must apply for AI Act designation by 28 January 2028, so the pool of bodies able to assess those products is still changing. Ask a candidate body whether its AI Act designation is in place or pending, and what its timeline is for that status. Plan your product release around the confirmed status, not the expected one.
Subcontracting and staff gaps
A notified body may subcontract only with the provider's agreement and stays fully responsible for that work, and it must publish its subsidiaries. Delays appear when the assessment team lacks the AI, data or sector expertise the system needs, or when a subcontractor is brought in mid-review. Ask who will perform each part of the assessment, confirm that person's experience, and get subcontracting agreed before work starts.
How DeployOpen prepares your evidence before a notified body review
DeployOpen plans, implements and documents self-hosted platforms inside your own infrastructure, and prepares the systems, controls and evidence that a notified body will later examine. This work runs on a fixed scope agreed in writing before it starts, so the deliverables, the systems covered and the timeline are known to you and your assessor from the outset. DeployOpen does not act as a notified body. It does not assess your system, issue certificates, or guarantee that a notified body will reach a favorable outcome. Only the notified body you appoint can make that decision, and the organization remains responsible for its own compliance.
Preparation usually means assembling a documentation set mapped to the requirements the notified body will test, along with the technical records behind it: the quality management system procedures, risk management records, data governance documentation, logs and test results for the system under assessment. Before handover, confirm with your notified body which documents it expects, in what format, and whether it wants a single pack or access to a shared repository. Ask it to confirm the version of the Act and harmonised standards it will assess against, since the dates in the 2026 amendment affect what is in scope.
At handover, DeployOpen delivers the evidence pack with a version-controlled index, a record of who produced each item and when, and the configuration exports that show how the self-hosted platform was set up. Your team should review the pack before the notified body does, confirm that every claim points to a retrievable record, and agree with the assessor who will answer questions during the review. Raise the handover format and the review contacts in the written scope, so that gaps are found and fixed before the assessor's first request.
